CARY, N.C., Aug. 9, 2004--A global survey of more than 250 financial institutions and regulators indicates that one-fifth of such organizations still have no formal operational risk programs in place despite the advancing regulatory compliance schedule associated with the New Basel Capital Accord, or Basel II. The latest draft of Basel II published in June 2004 will once again place regulatory requirements at the top of the agenda. Basel II updates and expands 1988 capital rules for risk management practices.

The survey of medium and large financial institutions, conducted by the Risk Waters Group and SAS, the leader in business intelligence, identified the credit and operational risk priorities for financial services firms. The findings reveal that 19 percent have not yet identified the best organizational framework for addressing operational risk. These companies cite difficulties in collating clean data and poor awareness among staff as major obstacles, despite average reported losses of $18.8 million per year.

"To meet the basic principles of Basel II, banks need to collect and analyze data for both credit and operational risk. However, the more advanced organizations are not solely driven by regulatory requirements but also by good business sense," said Peyman Mestchian, head of the risk management practice for SAS UK. "The research sought to identify key drivers and demonstrates how the market has moved, with many now seeing both operational and credit risk management as an opportunity rather than red tape."

Regulatory requirements are clearly top of mind for the respondents. When asked to rate the primary factors driving operational risk programs, executives at the financial institutions identified Basel II and related domestic regulation as the most important reason. Meeting regulatory requirements is also identified at the top of the list of key factors influencing credit risk programs.

Business performance factors rated equally high for driving programs for both credit and operational risk. Respondents estimated that they could reduce economic capital by 10 percent, on average, as a result of both operational and credit risk programs.

For example, in a medium- to large-sized bank with 20 percent of its $10 billion economic capital allocated to operational risk, this translates into a $200 million reduction. Applying a standard 10 percent, rate for cost of capital , the expected benefit from enhanced operational risk management would be $20 million per year. "If applied over five years, the business case for a risk management program using the calculations above becomes very strong indeed. The findings show that organizations are able to quantify the real benefits from effective operational and credit risk programs and the resulting impact on the bottom line," added Mestchian.

While Basel II is clearly influencing credit and operational risk management programs, it is the benefits to business - and not regulatory requirements - that are driving the agenda for risk managers.

"It appears that the lack of a clear regulatory framework may be holding some organizations back. The draft of the Basel II accord may spur those organizations into action," noted Mestchian. "However, the most successful will be those that avoid the scattershot approach and view compliance as an opportunity to initiate an integrated and coordinated risk governance program supported by a robust business case."

For a summary of the survey results, please visit www.sas.com/orsurvey for the operational risk survey results and www.sas.com/crsurvey for the credit risk survey results.

Difficulties in collating clean data and poor awareness among staff are the major obstacles to effective operational risk management, according to a recent survey by Risk Waters Group and SAS, the leader in business intelligence.

The survey of more than 250 financial institutions and regulators identified managing data quality as the No. 1 issue, with respondents reporting difficulties in collating sufficient volumes of historical data and in ensuring reliable data. The second most pressing issue was the poor overall awareness of operational risk issues by staff, due largely to lack of clear education programs in operational risk, lack of communication and limited knowledge sharing.

Regulations such as Basel II place a growing emphasis on operational risk management within financial institutions. Banks are compelled to gather data that they do not currently collect; they are also required to bring that data together from a host of disparate systems into one pool for analysis.

"The two key barriers to financial institutions achieving success relate to basic issues such as data quality and awareness amongst staff. A basic lack of awareness amongst staff often results in insufficient data being collected," said Peyman Mestchian, head of the risk management practice, SAS UK.

"Employees may not always report losses and therefore impact the accuracy of data available. They need to be educated to a level where they are providing consistent information therefore improving data accuracy. Organizations can use the most sophisticated analytical tools in the world, however if they are not working with comprehensive, real-world data they will miss the real dangers. Inconsistent and inaccurate data will only provide problems and create disagreements. These issues need to be addressed as a matter of some urgency, particularly with latest draft of the New Basel Accord (Basel II) published in June," continued Mestchian.

To comply with new regulations, organizations require systems that are both scalable and flexible. Systems need to combine qualitative and quantitative data and be able to link external data with internal data. Yet for many having the correct systems in place is still a major challenge.

Survey respondents ranked IT systems failure as the main source of operational risk. An area of growing importance was identified as customer relationship risk, with regulatory and compliance issues (including taxation) third.

"Definitional issues aside, in surveys like this, companies often report what they can most easily identify and quantify as a risk. One could argue that the loss of key personnel in a bank is a much greater risk than IT systems failures, which are already subjected to all sorts of controls such as disaster recovery and business continuity planning. However, people-related risks are harder to identify and quantify so they are not as visible," added Mestchian.

While the survey reveals progress over the past 12 months, there is still a lot to do. Operational risk is less well defined and potentially a greater challenge than credit and market risk. Incredibly, 19% of global respondents do not even have a program in place. This can be attributed to an organization's size; institutions with an annual turnover of less than $100 million are most likely not to have a program.

Respondents quantifying the economic returns of a successful operational risk program revealed expected savings running into tens of millions of dollars annually for large financial institutions. On average respondents expect 17% reduction in loss.

"Financial institutions now recognize that a successful operational risk management program will deliver clear economic rewards and business benefits. Benefits identified include increased revenue and better business performance. Improving performance is top of the list of main benefits for successful operational risk management; respondents placed this ahead of reduction in operational losses and protection against loss of reputation," said Mestchian

"The survey suggests that while organizations continue to spend more on operational risk management, the rate of increase has slowed considerably. The bottom line is that organizations need to focus on their data, processes and people, and not get too hung up on regulatory details," concluded Mestchian.

For a summary of the survey results, please visit www.sas.com/orsurvey.

About SAS(R) Credit Risk Management

To help institutions establish a risk management program, SAS offers SAS Credit Risk Management, an optimal foundation for financial institutions to comply with aspects of Basel II related to credit risk. The SAS solution provides a complete view of an institution's risk position for best credit risk management practices, well beyond the specific Basel II requirements. For more information on SAS Credit Risk Management, please visit (www.sas.com/industry/fsi/credit).

About SAS(R) OpRisk Management

SAS recognizes the growing need for financial institutions to measure and manage operational risk in a scientific way -- not just for regulatory requirements. With powerful data management, analytics and regulatory reporting and disclosure capabilities, SAS OpRisk Management helps institutions optimize capital allocation while mitigating risks. It is comprised of three key components:

-- SAS(R) OpRisk Monitor, a Web-based application that collects, manages, tracks and reports information about operational loss events, key risk indicators, risk-assessment maps and control-assessment scores.

-- SAS(R) OpRisk VaR, a sophisticated, yet user-friendly analytic VaR (Value at Risk) model that enables users to splice, dice, drill-down, adjust, trend and plot operational loss data at will, following a fully transparent, intuitive and sequential process.

-- SAS(R) OpRisk Global Data, a comprehensive database of external loss data that enriches the statistical sample used for modeling, documenting more than 10,000 publicly reported operational loss events of $1 million or more.

These components equip financial institutions with the tools needed to measure and manage operational risk in conformity with industry best practices and Basel II. For more information on SAS OpRisk Management, please visit (www.sas.com/industry/fsi/oprisk).

About SAS

SAS is the market leader in providing a new generation of business intelligence software and services that create true enterprise intelligence. SAS solutions are used at more than 40,000 sites -- including 96 of the top 100 companies on the FORTUNE Global 500(R) -- to develop more profitable relationships with customers and suppliers; to enable better, more accurate and informed decisions; and to drive organizations forward. SAS is the only vendor that completely integrates leading data warehousing, analytics and traditional BI applications to create intelligence from massive amounts of data. For nearly three decades, SAS has been giving customers around the world The Power to Know(R). Visit us at www.sas.com.

SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. (R) indicates USA registration. Other brand and product names are trademarks of their respective companies.

Copyright (C) 2004 SAS Institute Inc. Cary, NC, USA. All rights reserved.

SAS Institute Inc.
Kris Balic, 919-531-0624; Kris.Balic@sas.com
or
SAS UK press office, +44 (0) 870 990 5436;
saspressoffice@webergroup.co.uk
www.sas.com/presscenter 

At a Glance SAS 
Headquarters: Cary, NC 
Website: http://www.sas.com 
CEO: Jim Goodnight 
Employees: 9,289 
Organization: Private 
Revenues: $1.34 billion (2003)